The model
never touches
the page.

Window

One page, one debug panel.

The address bar has Back, Forward, Reload, Stop, and a URL field. The target page is a separate WebContentsView: nodeIntegration off, contextIsolation on, sandbox on, no preload. The debug tabs are Network, Console, Snapshot, Agent, and Settings. An approval request switches to Agent.

The Agent tab has a task field (the placeholder example is “Why is login failing?”), Run Agent, Cancel, Manual Tools, an Activity feed, and Agent Result. Page-derived tool output is marked “untrusted page content”. Evidence in a result can jump to Network, Console, or Snapshot.

Settings cards are Capture, Security, Browser, and LLM. Capture covers max body bytes, POST data, response bodies, and a Redact secrets control described as masking authorization headers, tokens, and cookies. Content boundaries stay on. Allowed domains are one domain per line; empty means allow all. Viewport, user agent, and timeout come from the environment or a config file. The LLM card keeps the provider, the model, and the name of the variable that holds the key.

Containment

The record is redacted before the model sees it.

CDP events from the target page stay in the main process. NetworkRecorder and ConsoleRecorder redact secrets and write CaptureStore. Tool handlers read that store. ContentBoundaryWrapper wraps page text with a nonce for the run. AgentRunner calls only toolRegistry.run(), then the provider: mock by default, or anthropic.

1. Target page
2. CDP in main
3. Recorders
4. CaptureStore
5. ToolRegistry
6. Content boundary
7. AgentRunner
8. mock or anthropic

The renderer talks through window.debuggerApp, exposed by the preload contextBridge. Raw ipcRenderer is not exposed. require inside the target page is undefined.

Sandboxed page

nodeIntegration false, contextIsolation true, sandbox true, no preload.

CDP in main

The renderer and the target page never call CDP. CDPClient lives in the main process.

Tools only

The agent loop does not call CDP, the filesystem, or the network itself.

Page boundary

Tools whose output is page data are wrapped before that text reaches the model, so page content cannot rewrite the prompt.

Default deny

Deny beats confirm, then allow. A category the policy does not name is confirm.

Tool registry

Thirty-two tools, sorted by category.

Risk on a tool is read or page_action. The lane comes from the category, not from that risk label. dialog.accept and dialog.dismiss are page_action and still allowed, because dialog is on the allow list.

Deny covers eval, network, state, download, and upload. None of those categories has a configured tool. Precedence is deny, then confirm, then allow.

Install

Tap, then install the cask.

The Homebrew cask is ai-web-debugger in dickwu/tap. It requires macOS Big Sur or newer on Apple silicon, and it installs AI Web Debugger.app from the arm64 disk image. The cask homepage is the GitHub repo.

brew tap dickwu/tap
brew install --cask ai-web-debugger

brew install --cask dickwu/tap/ai-web-debugger

sudo xattr -d com.apple.quarantine /Applications/AI\ Web\ Debugger.app/

git clone https://github.com/dickwu/ai-web-debugger.git
cd ai-web-debugger
bun install
bun run dev
bun run fixture

1. Tap dickwu/tap and install the ai-web-debugger cask, or download the arm64 disk image.
2. If macOS quarantines the app, clear the quarantine flag, then open AI Web Debugger.
3. Open the fixture or any page you are willing to expose to the tool list. Run a task from the Agent tab.

On disk

Settings load in order. Later entries win.

v0.1 limits

What this version does not do.

• One target WebContentsView per session. No multi-tab.
• No full iframe or OOPIF tracking.
• CaptureStore is in memory. No SQLite.
• Distribution builds are not code-signed or notarized.
• No tools that intercept or mutate network requests.
• page.wait_for implements a subset of Playwright-style assertions.
• Providers are mock and anthropic. No OpenAI adapter.

Questions

Questions people ask.